Event messages can expose selected log attributes needed to contextualize correlated detections. That principle matters when a threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context.

Event-handler matching depends on correct log type, subtype, action and field semantics. That principle matters when an event handler is configured to detect malware quarantine, but its filter searches generic traffic logs instead of antivirus records. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context.

Incident severity should be supported by full case context rather than transient table filtering. That principle matters when an incident's severity is reduced because only one alert remains visible after filters are changed, even though its earlier indicators persist. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context.

Check whether required historical data was purged from SQL and whether recovery is possible from retained archives. That action applies when a report generation error began immediately after an administrator shortened the ADOM Analytics retention period. It does not resolve the current source condition: A weekly PDF report becomes too large to email because it includes extensive raw log tables and high-resolution images. The relevant correction is: Limit the layout to requested measured summaries and use appropriate output or external storage settings.

Stagger the reports and constrain heavy datasets according to capacity and business need. That action applies when Two report jobs run concurrently against the same large dataset and saturate the analytics system during peak business hours. It does not resolve the current source condition: A weekly PDF report becomes too large to email because it includes extensive raw log tables and high-resolution images. The relevant correction is: Limit the layout to requested measured summaries and use appropriate output or external storage settings.

Create or select a compatible dataset, then bind the chart to that dataset and its output columns. That action applies when an analyst creates a custom chart without first defining a dataset for its source fields. It does not resolve the current source condition: A weekly PDF report becomes too large to email because it includes extensive raw log tables and high-resolution images. The relevant correction is: Limit the layout to requested measured summaries and use appropriate output or external storage settings.

Incident assertions should be grounded in retained source evidence and explicit uncertainty. That principle matters when an investigation has no linked logs because analytics retention expired, but the case owner still cites a specific original file hash as proven. It is not the mechanism explaining the selected response to the present facts. Playbook trigger filters decide which incoming events begin automated task execution.

Automation connector tasks depend on valid service identity and the target API's access permissions. That principle matters when a playbook uses an external ticketing connector but its credentials have expired after a password rotation. It is not the mechanism explaining the selected response to the present facts. Playbook trigger filters decide which incoming events begin automated task execution.

Event messages can expose selected log attributes needed to contextualize correlated detections. That principle matters when a threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. It is not the mechanism explaining the selected response to the present facts. Playbook trigger filters decide which incoming events begin automated task execution.

The target case gains the new evidence without creating a duplicate incident. That outcome would be relevant when a responder wants to attach evidence to an existing incident but builds a playbook task using the local Create Incident action. The decisive evidence is: A test case in each tenant affects only its approved devices and incident records.

A missing-indicator test ends safely without a containment request and logs the reason. That outcome would be relevant when a playbook's indicator lookup task returns an empty value but the following IP-block action still sends an API request. The decisive evidence is: A test case in each tenant affects only its approved devices and incident records.

A test with matched host identifiers raises an event, while unrelated-host records do not. That outcome would be relevant when a correlation rule detects suspicious DNS and IPS records but the team has not verified they refer to the same host. The decisive evidence is: A test case in each tenant affects only its approved devices and incident records.

A repeat execution enriches or updates the original case without raising duplicate tickets. That outcome would be relevant when an on-demand forensic workflow needs the ability to read incident details but is configured to create a new case each time it runs. The decisive evidence is: The incident list and audit history reflect who owns the investigation and its next action.

A simulated incident update changes exactly the targeted case with a traceable audit entry. That outcome would be relevant when a playbook task passes an incident identifier in the wrong field to Update Incident and changes an unrelated case. The decisive evidence is: The incident list and audit history reflect who owns the investigation and its next action.

The incident notes separate historical reputation from current activity and justifies any response. That outcome would be relevant when a malicious indicator is enriched successfully but its last-seen timestamp is weeks older than the investigation window. The decisive evidence is: The incident list and audit history reflect who owns the investigation and its next action.

Choose appropriate Security Fabric or supported product-specific ADOM organization and validate device type support. That action applies when a Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. It does not resolve the current source condition: An analyst expects FortiAnalyzer to begin displaying VPN events immediately after it is added as a Fabric analysis endpoint, but FortiGate logging is disabled. The relevant correction is: Configure the FortiGate to generate and forward relevant event categories and verify the destination setting.

Inspect Analytics insertion backlog, database capacity and device reception separately before adjusting network routes. That action applies when the SQL database is nearly full after a traffic surge, but the team diagnoses a broken FortiGate transport because report data is late. It does not resolve the current source condition: An analyst expects FortiAnalyzer to begin displaying VPN events immediately after it is added as a Fabric analysis endpoint, but FortiGate logging is disabled. The relevant correction is: Configure the FortiGate to generate and forward relevant event categories and verify the destination setting.

Use indicator enrichment for threat context and correlate matching original logs for packet or session evidence. That action applies when a SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. It does not resolve the current source condition: An analyst expects FortiAnalyzer to begin displaying VPN events immediately after it is added as a Fabric analysis endpoint, but FortiGate logging is disabled. The relevant correction is: Configure the FortiGate to generate and forward relevant event categories and verify the destination setting.

The generated weekly report arrives at the authorized recipient following the configured cadence. That outcome would be relevant when a security officer requests a weekly report, but the administrator creates a correct report definition and never schedules it. The decisive evidence is: Two test runs consistently include the intended daily or monthly periods.

The report includes the intended records after they become queryable or the limitation is documented. That outcome would be relevant when a monthly report contains no data although matching events are visible in Log View's real-time display. The decisive evidence is: Two test runs consistently include the intended daily or monthly periods.

The task resumes or returns a precise failure reason after the actual system bottleneck is resolved. That outcome would be relevant when a scheduled report remains Pending for hours, and the team immediately edits report charts without checking system tasks. The decisive evidence is: Two test runs consistently include the intended daily or monthly periods.

Record ADOM, device inventory, access profile and saved time range with each exported result. That action applies when Two analysts compare a saved FortiView filter but their ADOM permissions yield different devices and apparently inconsistent totals. It does not resolve the current source condition: A newly created report template has the correct charts but the security officer receives only an outdated attachment. The relevant correction is: Verify the report schedule, output profile, delivery destination and most recent generated revision.

Inspect the empty chart's dataset, log type and filters independently of the populated chart. That action applies when a report contains a chart with zero rows even though a different chart on the same page is populated. It does not resolve the current source condition: A newly created report template has the correct charts but the security officer receives only an outdated attachment. The relevant correction is: Verify the report schedule, output profile, delivery destination and most recent generated revision.

Normalize the incident window across device logs and explicitly record which timezone labels are displayed. That action applies when a suspected lateral-movement timeline starts at midnight UTC, yet the response shift uses the local appliance timezone. It does not resolve the current source condition: A newly created report template has the correct charts but the security officer receives only an outdated attachment. The relevant correction is: Verify the report schedule, output profile, delivery destination and most recent generated revision.

Wait for supported enrichment results, assess confidence and save the reviewed enrichment context. That action applies when an analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. It does not resolve the current source condition: A FortiAnalyzer playbook is saved with an ON_DEMAND trigger, yet the team expects it to run automatically whenever a new event appears. The relevant correction is: Choose an appropriate supported event trigger or explicitly launch the on-demand playbook as intended.

Add traceable device identifiers, input values and task outcomes to the incident audit evidence. That action applies when a response engineer wants to roll back a failed containment action but the playbook has no record of which firewall or indicator was changed. It does not resolve the current source condition: A FortiAnalyzer playbook is saved with an ON_DEMAND trigger, yet the team expects it to run automatically whenever a new event appears. The relevant correction is: Choose an appropriate supported event trigger or explicitly launch the on-demand playbook as intended.

Use the built-in local connector Run Report action and pass the intended report identity. That action applies when an analyst attempts to run a predefined FortiAnalyzer report from a playbook using an unrelated FortiOS webhook action. It does not resolve the current source condition: A FortiAnalyzer playbook is saved with an ON_DEMAND trigger, yet the team expects it to run automatically whenever a new event appears. The relevant correction is: Choose an appropriate supported event trigger or explicitly launch the on-demand playbook as intended.

FortiView geographic maps summarize selected log dimensions without proving common adversary control. That principle matters when a geo map widget plots many connections from one cloud provider country and analysts attribute all connections to one attacker. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer visualizations depend on actual collected and indexed fields and log categories.

Dataset query selectivity affects report-generation cost on the log SQL database. That principle matters when a high-volume daily report takes far longer than expected after an analyst removes all date and device filters from a custom dataset. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer visualizations depend on actual collected and indexed fields and log categories.

FortiAnalyzer report caching trades query speed against freshness of generated content. That principle matters when a report shows stale counts after an analyst assumes a cached preview was regenerated with every new log. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer visualizations depend on actual collected and indexed fields and log categories.

Plan an independent resilience and evidence-custody strategy matching loss-of-link and appliance failure requirements. That action applies when After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. It does not resolve the current source condition: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. The relevant correction is: Include VDOM and ADOM context in log investigations and apply authorized tenant-specific filters.

Correlate connector reachability, playbook execution history and task-level outcomes before confirming response. That action applies when a management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. It does not resolve the current source condition: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. The relevant correction is: Include VDOM and ADOM context in log investigations and apply authorized tenant-specific filters.

Check raw action values and use a validated matching expression covering the intended normalized action set. That action applies when a filter for denied traffic finds no data because source devices label actions with several supported drop and deny variants. It does not resolve the current source condition: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. The relevant correction is: Include VDOM and ADOM context in log investigations and apply authorized tenant-specific filters.